Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\nsr21b4.tmp\inetc.dll
- C:\acorn\acvirtual_accnt.pbd
- C:\acorn\acwhowho.pbd
- C:\acorn\acxtra.pbd
- C:\acorn\acxtradw.pbd
- C:\acorn\appeon_workarounds.pbd
- C:\acorn\acstore.pbd
- C:\acorn\acvendor.pbd
- C:\acorn\atl71.dll
- C:\acorn\libjutils.dll
- C:\acorn\msvcp71.dll
- C:\acorn\msvcr71.dll
- C:\acorn\odbcad32.exe
- C:\acorn\pbnetwsruntime105.dll
- C:\acorn\gdiplus.dll
- C:\acorn\libjcc.dll
- C:\acorn\acsms.pbd
- C:\acorn\acsettle.pbd
- C:\acorn\acsecurity.pbd
- C:\acorn\acsalesop.pbd
- C:\acorn\acsalesopdw.pbd
- C:\acorn\acsalestamp.pbd
- C:\acorn\acsappr.pbd
- C:\acorn\acsc_cancel.pbd
- C:\acorn\acscb.pbd
- C:\acorn\acsales_order.pbd
- C:\acorn\acsda.pbd
- C:\acorn\acsdc.pbd
- C:\acorn\acsdcdw.pbd
- C:\acorn\acsdd.pbd
- C:\acorn\acsdp.pbd
- C:\acorn\acsds.pbd
- C:\acorn\acsdx.pbd
- C:\acorn\acsdapic.pbd
- C:\acorn\pbxerces105.dll
- C:\acorn\pbado105.dll
- %TEMP%\nsh388e.tmp\selfdel.dll
- C:\acorn\pbase105.dll
- C:\acorn\pbvm105.dll
- C:\acorn\acorn_hb_updtr.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\acorn\acorn_hb.lnk
- %HOMEPATH%\desktop\acorn_hb.lnk
- C:\acorn\acorn_flvsn.url
- C:\acorn\pbtra105.dll
- C:\acorn\pbtrs105.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\acorn\website.lnk
- %TEMP%\nsrd6b0.tmp\selfdel.dll
- %TEMP%\nsh149a.tmp\inetc.dll
- %TEMP%\nsh149a.tmp\killproc.dll
- %TEMP%\nsh388e.tmp\inetc.dll
- %TEMP%\nsh388e.tmp\killproc.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\acorn\uninstall.lnk
- C:\acorn\uninst.exe
- C:\acorn\pbsyj105.dll
- C:\acorn\pbsyc105.dll
- C:\acorn\pbshr105.dll
- C:\acorn\pbdir105.dll
- C:\acorn\pbdwe105.dll
- C:\acorn\pbdwr105.dll
- C:\acorn\pbdwr105.pbd
- C:\acorn\pbin9105.dll
- C:\acorn\pbjag105.dll
- C:\acorn\pbcomrt105.dll
- C:\acorn\pbjdb105.dll
- C:\acorn\pbo10105.dll
- C:\acorn\pbo84105.dll
- C:\acorn\pbo90105.dll
- C:\acorn\pbodb105.dll
- C:\acorn\pbole105.dll
- C:\acorn\pbrtc105.dll
- C:\acorn\pbjvm105.dll
- C:\acorn\acsales02.pbd
- C:\acorn\pbacc105.dll
- C:\acorn\acsales01.pbd
- C:\acorn\acdeal_logis.pbd
- C:\acorn\acbuying.pbd
- C:\acorn\acbuyingdw.pbd
- C:\acorn\accargo.pbd
- C:\acorn\accmdt_ctrl.pbd
- C:\acorn\accode.pbd
- C:\acorn\acbboard.pbd
- C:\acorn\acbiz_zone.pbd
- C:\acorn\accommodity.pbd
- C:\acorn\accontractdw.pbd
- C:\acorn\acdeal_collect.pbd
- C:\acorn\acdeal_if.pbd
- C:\acorn\acdeal_inv_tax.pbd
- C:\acorn\acdeal_invdw.pbd
- C:\acorn\accommoditydw.pbd
- C:\acorn\accontract.pbd
- C:\acorn\acbasedw.pbd
- C:\acorn\acbase.pbd
- C:\acorn\acassets.pbd
- %TEMP%\nsr21b4.tmp\killproc.dll
- %TEMP%\acorn_hb_lnchr.exe
- C:\acorn\acorn.ini
- %TEMP%\nsg367b.tmp\inetc.dll
- %TEMP%\acorn_hb.exe
- %TEMP%\nsg367b.tmp\selfdel.dll
- %TEMP%\svr_oak_version.ini
- %TEMP%\nsrd6b0.tmp\killproc.dll
- C:\acorn\$oainherit.pbd
- C:\acorn\$oamethod.pbd
- C:\acorn\$oaobjects.pbd
- C:\acorn\ac_as.pbd
- C:\acorn\acaccount.pbd
- C:\acorn\acar.pbd
- C:\acorn\$oadw2xls.pbd
- C:\acorn\acdeal_invoice.pbd
- C:\acorn\acdeal_order.pbd
- C:\acorn\acpurchasedw.pbd
- C:\acorn\acdeal_rpt01.pbd
- C:\acorn\acmem_store.pbd
- C:\acorn\acmember.pbd
- C:\acorn\acmemberdw.pbd
- C:\acorn\acmethod.pbd
- C:\acorn\acmis.pbd
- C:\acorn\acmanufacture.pbd
- C:\acorn\acmem_event.pbd
- C:\acorn\acmisdw.pbd
- C:\acorn\acpipeline.pbd
- C:\acorn\acprimecost.pbd
- C:\acorn\acproduct.pbd
- C:\acorn\acproductdw.pbd
- C:\acorn\acpurchase.pbd
- C:\acorn\acorn.exe
- C:\acorn\acorn.pbd
- C:\acorn\aclabelprint.pbd
- C:\acorn\acinventory.pbd
- C:\acorn\acinteriordw.pbd
- C:\acorn\acdeal_vndr.pbd
- C:\acorn\acdealanadw.pbd
- C:\acorn\acdealanaobj.pbd
- C:\acorn\acdealdw.pbd
- C:\acorn\acdealobj.pbd
- C:\acorn\aceducation.pbd
- C:\acorn\acdeal_rpt02.pbd
- C:\acorn\aceducationdw.pbd
- C:\acorn\acemplyeedw.pbd
- C:\acorn\acerror.pbd
- C:\acorn\acfc_counsel.pbd
- C:\acorn\acfranchise.pbd
- C:\acorn\acgoods.pbd
- C:\acorn\acinterior.pbd
- C:\acorn\acemplyee.pbd
- C:\acorn\acsa.pbd
- %TEMP%\nsw49fb.tmp\inetc.dll
Deletes the following files
- %TEMP%\svr_oak_version.ini
- %TEMP%\acorn_hb_lnchr.exe
- %TEMP%\nsr21b4.tmp\inetc.dll
- %TEMP%\nsr21b4.tmp\killproc.dll
- %TEMP%\nsg367b.tmp\inetc.dll
- %TEMP%\nsg367b.tmp\selfdel.dll
- %TEMP%\nsrd6b0.tmp\killproc.dll
- %TEMP%\nsrd6b0.tmp\selfdel.dll
- %TEMP%\acorn_hb.exe
- %TEMP%\nsh388e.tmp\inetc.dll
- %TEMP%\nsh388e.tmp\killproc.dll
- %TEMP%\nsh388e.tmp\selfdel.dll
Substitutes the following files
- %TEMP%\svr_oak_version.ini
- %TEMP%\acorn_hb_lnchr.exe
Network activity
Connects to
- 'up####.champlus.co.kr':80
TCP
HTTP GET requests
- http://up####.champlus.co.kr/update/svr_oak_version.ini
- http://up####.champlus.co.kr/update/Acorn/Acorn_HB_lnchr.exe
- http://up####.tpay.co.kr/update/Acorn/Acorn_HB.exe
- http://up####.tpay.co.kr/update/svr_oak_version.ini
- http://up####.tpay.co.kr/update/Acorn/Acorn_HB_updtr.exe
UDP
- DNS ASK up####.champlus.co.kr
- DNS ASK up####.tpay.co.kr
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%TEMP%\acorn_hb.exe'
- 'C:\acorn\acorn_hb_updtr.exe'
Executes the following
- '%WINDIR%\syswow64\explorer.exe'
